According to its self-reported version number, Lodash is prior to 4.17.20. It is, therefore, affected by a prototype pollution vulnerability in zipObjectDeep.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3369 advisory.

  - nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)

  - golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic (CVE-2020-9283)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - macaron: open redirect in the static handler (CVE-2020-12666)

  - golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash     (CVE-2020-14040)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 17.12.11, 18.8.11, 19.12.10, and 20.12.0 versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Nimbus JOSE+JWT)). Supported versions that are affected are 18.8.0-18.8.11. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera     Gateway. Successful attacks of this vulnerability can result in takeover of Primavera Gateway.
    (CVE-2019-17195)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Lodash)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.11, 19.12.0-19.12.10 and     20.12.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Primavera Gateway accessible data and     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway.
    (CVE-2020-8203)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Netty)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.11 and 19.12.0-19.12.10.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Primavera Gateway accessible data.
    (CVE-2021-21409)     
  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component:
    jackson-databind). (CVE-2020-36189)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5179 advisory.

  - nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript     execution (CVE-2019-20920)

  - nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS     (CVE-2019-20922)

  - nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5611 advisory.

  - lldpd: buffer overflow in the lldp_decode function in daemon/protocols/lldp.c (CVE-2015-8011)

  - nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3807 advisory.

  - nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - ovirt-engine: Reflected cross site scripting vulnerability (CVE-2020-14333)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
113007	Lodash < 4.17.20 Prototype Pollution	Web App Scanning	Component Vulnerability	10/4/2021	3/14/2023	high
139385	RHEL 7 / 8 : Red Hat OpenShift Service Mesh (RHSA-2020:3369)	Nessus	Red Hat Local Security Checks	8/7/2020	4/28/2024	high
151974	Oracle Primavera Gateway (Jul 2021 CPU)	Nessus	CGI abuses	7/22/2021	12/7/2023	critical
143235	RHEL 8 : Red Hat Virtualization (RHSA-2020:5179)	Nessus	Red Hat Local Security Checks	11/24/2020	2/8/2024	high
144405	RHEL 8 : Red Hat Virtualization (RHSA-2020:5611)	Nessus	Red Hat Local Security Checks	12/18/2020	4/28/2024	critical
140750	RHEL 8 : Red Hat Virtualization (RHSA-2020:3807)	Nessus	Red Hat Local Security Checks	9/23/2020	4/28/2024	high

Detections

Analytics

Plugins Search

high

high

critical

high

critical

high